Analysis Overview
SHA256
e5ba9da97a3feb252e3b88d7d027f4abe2d180e733ed63d068e4631f8a058e7f
Threat Level: No (potentially) malicious behavior was detected
The file a47605c5a0d4e0a0471982e1bfe5b56d_JaffaCakes118 was found to be: No (potentially) malicious behavior was detected.
Malicious Activity Summary
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates system info in registry
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of SendNotifyMessage
Modifies Internet Explorer settings
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-06-13 07:38
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2024-06-13 07:38
Reported
2024-06-13 07:40
Platform
win7-20240611-en
Max time kernel
137s
Max time network
134s
Command Line
Signatures
Modifies Internet Explorer settings
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E639E471-2957-11EF-AF9B-7E1039193522} = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424426167" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a807600000000020000000000106600000001000020000000607aa305f1fbd1378adcef4c72012c2567cdfe297a3e41bfc35a782e51681fd1000000000e80000000020000200000009c4d14d576004888a3fdb60002315137f91d4adf083e4b801d8e512bdcfe37a49000000000bb54f39d6571c168dd27f1f720f04c15edf080fc33a8a529c6d03f15d52a2de1f8d1a62d2487ed26a7289255d7dae042049d2b1964a28a5b8a305083c1c140567c9e930a2bc5b64bd4bced47f91f7c4ccb2c9072b73180bad7ed242e67317a58a6ac12057d4410509a18e24a26fefd239a118fb8eeead308f5effcbaf980617e3404828dc01b5c2604a4558050385d400000001b045defa43f64ebe1fc96ad19709ed33415e3e9cce3d996437e423b6f6af3568dfa1bbf4d984c1949a5417549fd7497f36a1cd90955731ec686511e678bf68f | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a8076000000000200000000001066000000010000200000006c43d02fbdf7a817680344efbcab4f4d0237961cb585a6d36626c065bb26058b000000000e800000000200002000000001e3fc1ced81a6f17aa6b0837c2cdb51c41491d3ea27eee7434b3072681661de200000007369cfcd44aa925631e79848512e27ee0911912909185b5cb01fb1a579d4e83e400000004f7a5c0d50597a0aacd75f2f65011cc604575248712865f21dc068f1f1f5f680cda8fc99d73b23c0010b75d88783c9f44e1ec427aa37d9a82dc4a3541c80b58d | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60a909bc64bdda01 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| N/A | N/A | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 1176 wrote to memory of 3040 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
| PID 1176 wrote to memory of 3040 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
| PID 1176 wrote to memory of 3040 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
| PID 1176 wrote to memory of 3040 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
Processes
C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a47605c5a0d4e0a0471982e1bfe5b56d_JaffaCakes118.html
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1176 CREDAT:275457 /prefetch:2
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | stackpath.bootstrapcdn.com | udp |
| US | 8.8.8.8:53 | use.fontawesome.com | udp |
| US | 8.8.8.8:53 | cdnjs.cloudflare.com | udp |
| NL | 178.128.249.247:80 | 178.128.249.247 | tcp |
| NL | 178.128.249.247:80 | 178.128.249.247 | tcp |
| NL | 178.128.249.247:80 | 178.128.249.247 | tcp |
| US | 104.18.11.207:443 | stackpath.bootstrapcdn.com | tcp |
| US | 104.21.27.152:443 | use.fontawesome.com | tcp |
| US | 104.18.11.207:443 | stackpath.bootstrapcdn.com | tcp |
| US | 104.17.24.14:443 | cdnjs.cloudflare.com | tcp |
| NL | 178.128.249.247:80 | 178.128.249.247 | tcp |
| US | 104.21.27.152:443 | use.fontawesome.com | tcp |
| US | 104.17.24.14:443 | cdnjs.cloudflare.com | tcp |
| NL | 178.128.249.247:80 | 178.128.249.247 | tcp |
| NL | 178.128.249.247:80 | 178.128.249.247 | tcp |
| NL | 178.128.249.247:80 | 178.128.249.247 | tcp |
| NL | 178.128.249.247:80 | 178.128.249.247 | tcp |
| NL | 178.128.249.247:80 | 178.128.249.247 | tcp |
| NL | 178.128.249.247:80 | 178.128.249.247 | tcp |
| NL | 178.128.249.247:80 | 178.128.249.247 | tcp |
| NL | 178.128.249.247:80 | 178.128.249.247 | tcp |
| NL | 178.128.249.247:80 | 178.128.249.247 | tcp |
| NL | 178.128.249.247:80 | 178.128.249.247 | tcp |
| NL | 178.128.249.247:80 | 178.128.249.247 | tcp |
| NL | 178.128.249.247:80 | 178.128.249.247 | tcp |
| NL | 178.128.249.247:80 | 178.128.249.247 | tcp |
| NL | 178.128.249.247:80 | 178.128.249.247 | tcp |
| US | 8.8.8.8:53 | apps.identrust.com | udp |
| US | 8.8.8.8:53 | apps.identrust.com | udp |
| BE | 23.14.90.91:80 | apps.identrust.com | tcp |
| BE | 23.14.90.91:80 | apps.identrust.com | tcp |
| US | 8.8.8.8:53 | x2.c.lencr.org | udp |
| US | 8.8.8.8:53 | x2.c.lencr.org | udp |
| BE | 23.55.97.11:80 | x2.c.lencr.org | tcp |
| BE | 23.55.97.11:80 | x2.c.lencr.org | tcp |
| US | 204.79.197.200:443 | ieonline.microsoft.com | tcp |
| US | 204.79.197.200:443 | ieonline.microsoft.com | tcp |
| US | 204.79.197.200:443 | ieonline.microsoft.com | tcp |
Files
C:\Users\Admin\AppData\Local\Temp\Cab584F.tmp
| MD5 | 49aebf8cbd62d92ac215b2923fb1b9f5 |
| SHA1 | 1723be06719828dda65ad804298d0431f6aff976 |
| SHA256 | b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f |
| SHA512 | bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b |
C:\Users\Admin\AppData\Local\Temp\Tar5862.tmp
| MD5 | 4ea6026cf93ec6338144661bf1202cd1 |
| SHA1 | a1dec9044f750ad887935a01430bf49322fbdcb7 |
| SHA256 | 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8 |
| SHA512 | 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
| MD5 | cb85f3fcf86ef0de7ef258539cae87de |
| SHA1 | c73288fff07885a62f8c7033b348863ed3b8cad1 |
| SHA256 | 7430a96d94b1faa5363b7656b323ffa416fd262e0405e498bb143dc93443963f |
| SHA512 | dc152f2e8c8f7e316e84f7a1f3996e02c08d582d6d0e40b8bf7171e359ea952a80b7452e56690b30fe98b4655d4744e8529a930449ef1cd853e377f86294b2d2 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
| MD5 | bc01db635c08f0f4c2c76eeaa0b5ded2 |
| SHA1 | 715395478fba81443627b0f10f861e617c28a636 |
| SHA256 | 687857ccba6b4936e59dcdbc4f95f9c02caf06a1e472ea216eb567104a018e67 |
| SHA512 | e9e10b6dcdaea84268478b42cd00830aa67baea3d2c9f76322076582adb95d518a7d79da58334a16dcdfe6fc98a2602c76882819d415e15fccf90b2d8ffd159b |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | f24dceb7473068e4bda0d599a47cab4e |
| SHA1 | 8912169f0581ad89466421e9b45e70a1855755b8 |
| SHA256 | 988f8041ccd86dc157d84e03630bef6e42a86d4ad53207832e27be654911f8a7 |
| SHA512 | 3b840727827683b39f6986a33fa3233e6ea0c3e868ea9fd0ad961dff728051d3870cbd29ece1e57e8cbf0f0b9b398fb5d74affa6f6a86c9a3dae24861545644c |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
| MD5 | ace0a5a70a4daa2edc27cfd60d7b3b94 |
| SHA1 | 59ea80f5658fe0a395cf5cb1ceadf95f4bfd2792 |
| SHA256 | 7fc4741935fb6134d6c13b27a064dc906db43efdbbaef858efe9f1f8aad37eb6 |
| SHA512 | 41b4bfb7691f0b62b0fe822a65e14cf5bfdd79ee3d77b728722c30828eaddcb90e6dcdc143346d8e917b83825c2a37605a81ba553187e22ac64e39f4395c898c |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 7d0960c2fc17c31e9035fe59a283e6b5 |
| SHA1 | ad57cf9aff1df40bc107843704892839774a6ccd |
| SHA256 | 2e472959b559d50ea9498427445739d823f50693f50bf037c665040513389bd9 |
| SHA512 | 674f0356547db7f95ac4d985985f9db318261c8dcf910e177c716de76306e97d63a57ac4462f63d888d4a7f0c33247eb3c5252fd07e239fa2ecbf872d93c50f0 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 20852ffda6d8d83d4b369a3697e7b02d |
| SHA1 | 5814e0ad626e7e19474c49ba734f9c1c94fe7d5e |
| SHA256 | cc0837989755b8250d5f1c6d89a202f169679c9761364818d01473a5a21530c6 |
| SHA512 | 8f684d22386771a461c086af9d54a8c2bcff20f8b518fe660a81b9d69091bb53f4b628488a44a57fdfcb9de21d7efdb8f5e2f0b82d0109470321a7513b196200 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 6bab27d59af07aa0c1f282d285312e18 |
| SHA1 | 25226a64dbf09a0bd43934e20d481ea138c7c22e |
| SHA256 | 2e7207c863e2bcb2c649d9523804dd9518f42e00fea108fb2569d103c1360cac |
| SHA512 | 5248da048a7215d947d88a8f14b563052d9f440362346d1f1585b9b05ee49f42eb05ae4a43f0ac4f2af565a7faffedba91f14d0b2e940da0e46c2985726935af |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 4ce18f8a5d5dd1b7fc7619f44b0663df |
| SHA1 | f985fa969673c6a6c7757044bf1bd2095f87fc5c |
| SHA256 | 876d860e14979497e60f4637d058120f0cf36ebe18b8fe26d4fdffa2d7ed4983 |
| SHA512 | 31b093fc146b93577878e8fd9981c505c9bb99574ac88834b756e009e694883acc0ce90b0c53a37d8413a4bb658cb226fa78438df246f5862ee31064766ce286 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 9593eb04259b29bd03314504240379fe |
| SHA1 | 07d765c60131eca80db0af238ba4b986eb3f2c8a |
| SHA256 | 0f551893baef3a559978a5fa38239b6da5ab2a3fa841df4a234679b5f887c33d |
| SHA512 | c318163d657fd70f058714f74882665299c31212ec0a181d506be3be620705e48f46f8882a8cc2d5bbd4b7fcc90d620eab97f190ac17c464fc59271e2027aa07 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 1e07c33884f245ffa55dbf72044d8066 |
| SHA1 | c4c35e0932a9740c8bf4f0c082069ab0de9470f7 |
| SHA256 | 924540ec510397dac6fde467d8d955c8bd84b8983dd0cb11c1c855bdcb42a547 |
| SHA512 | a2bf3bf8a3ba886e1fd2401fcacffc6fffa26bdf270dd42c7ea8ef07e8cc849c4a5ae95535c2c333c5fd7814e2bf01853662f4b9bca23157b14316f076f0bd12 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 082091f18323911ea9cfabb8f77df7e0 |
| SHA1 | 0656bcbb5309fa48479731336b8c5ca59a4569a3 |
| SHA256 | 72e5c14efdfdf97a13fbf84d0a9858cf2cd3e5076bcb0837f73daab5f46729f7 |
| SHA512 | 97e5131dc5bd8699c98b661bca2cf2cf50b134b4ca10c933a05b063ac810d744e146462eb65e9bc08ba9e8f4302dd78c74f402129c5513b660c51505750f7c2f |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | e68162a3d39b00e6a7f5e10ed9b29126 |
| SHA1 | 2de901608e578b0c2124adc960319e92d2b41d96 |
| SHA256 | ba68a7395fba8c8533786e602465ef171333484a4a7eb1bea71e1a547c42bc58 |
| SHA512 | 8108cc06482b5d6b66dc765e30e4abefdf739dcdd346fefc2ad6a3a9fcc77fa3fdfbcd2fc705b923158c529556913f5eb21ef05463bec7943e62b0718b8296ee |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | b2067343aeb6f16d519def23936a8ddd |
| SHA1 | ce8a69f4040e7c92a2a0634c72957d9085632eea |
| SHA256 | 1df1770b40b7c28fc878bfe399d1f89ff9d9efbe3b1a9c1628e9a2bd13d13a1f |
| SHA512 | 53556ea6e3d6a418173b4f760a7250d909f2e5f37719db00b5a8e5d688850a847329c2a9fbf4c4ab9334514cee7fed2dcfe3f2d778d2aeab33645384da3c5b18 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 9f036082ca1c82dfc614fa1a813bbbad |
| SHA1 | 6480c19052fe16f10e915bc89d673eaa8fb69c10 |
| SHA256 | c8f98a41a5c354f0cce215664e463fed5b5c93a6c1cac62e74c62f01f73eed2d |
| SHA512 | 47975b94ee6065003034ce06e6e53850557774cbc2cd022d661f6ff83f50e9ef6f0c0d6b6a0b79d688bde1d0524438887f8d29b70af84a95054cfb173a39b773 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 7d8571ebdc928028580a9a0bedc17508 |
| SHA1 | e2b3a39196621542320b8fcde3b3145fe08bd8b3 |
| SHA256 | 887066fda21ddccb4b248f80f68437f60f87156c9f068fb6b830df0e8819e71c |
| SHA512 | b48a2b927ca11f94d8e24a6c936a0e1d89688a3aa1a4951612459f690a1719bbb8b73fb51278b09f3661bd9a7e10e31f3b902e1d1282aa87f4541e5e9c681152 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | ad6d6265ff3451050af468e4a3f6532b |
| SHA1 | 05e5dc39cf9bb8a4df835c61620e1e9d725e0b10 |
| SHA256 | b3ce6be6b67401ec62c86738a41217eca8078e93864f88853f916d9cba4e64d1 |
| SHA512 | 10acab12eae870670e7c9d4b015084a6df16004d95a039b788256732cecdfe71063de1ed1996bc54a618134daa7cb3c09ed18725fdd139103b6b36e19ee1eade |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 24623f43531e6d76f757a65143111146 |
| SHA1 | a41e68b5fe82f4f06d212ea68c52d5e29f5d3829 |
| SHA256 | 244b2e5581db0e1c1f21045ff619dcdf00b48ce6031b180ec37f3d73581d3202 |
| SHA512 | cfd95b2d2d737404503629261e2ce59ec070d46ac16eef2e43aaaf21e85c7c5d15938f92f49a2287cc426430eda4ef583b8d98e7e52bdc12311d8aa1bb488cb6 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | c9369a1ea7be7271638e15fa92d0644f |
| SHA1 | 97910c9c3a87d5a690282ac7289fea58666151d7 |
| SHA256 | 89990f0ac9bec79d5499ebd9c9e2a4207574876a1e661736429ac6bf8d839b6d |
| SHA512 | 16126034fc15e1c98ca5c79da8ebd712b89b3bca5b76a0aa5373627accfadc3e28e3bde5d3e85fbe54851a4d50fcdcd925d0b8cc13bf2fb3c1f81be0afb51442 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | de214c2cb16c8734cb60dff87923858c |
| SHA1 | 78e01c8fd5bc726e4c37fcd3c853db4f2fcc2c8e |
| SHA256 | 3e77fdca3288aae0e0cbbeaee337ef6ff877979782e02165f9823c97ad6351c7 |
| SHA512 | a418fd5bbe02dfe21f10f3bad47aac323c9bdd39cc8da63ae00da15e1c8f78fc6afbb887caf933307587c83dd75ed3f246ea44cdb3e7699d946941692a8b697d |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 12448a6d4f82d9a55ee488cfbada472b |
| SHA1 | af1e1837f06b933401da5208f689bb4d1c02c025 |
| SHA256 | cad607569b5964c39428806e1361aa5db10a969d6cd01bf9ffc21d938b6a3712 |
| SHA512 | a1495d12a65cc066260617fc477a8e7d52a6a5a6b77a70194607a4f1a7b2134581d5894201c6a912b948f6e72985ab72acb8dbe4ffe57070c4bfe86564efddde |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 89073b809f9dc4c925f9442203ee019b |
| SHA1 | af54ac21be1e43c4ffa4a5007680a6764e681abe |
| SHA256 | 14d633051b36e1d69fe7cdcf33f25d11d28fc7cacbf79e55d9f2ab74e20e1477 |
| SHA512 | 8d4af51fbee6ce6e6bc65102efb3fb699951154caa31971085fd020d26c53760376f192ac6712069dfa9234aaddd5501008e9c6c6d2058dcc354a8f4110509e7 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 44c43f0588c842a2e5780810a5d13945 |
| SHA1 | 50c9511ca359f9c534abe497c09fbb626d32a681 |
| SHA256 | 803a10aa4b2a2b0474715157389473e81363bea758193d897699621e37796f4c |
| SHA512 | 7e51cd06d072dce232d3580bdc22fc31b80ed1a640bf4883f8630bc1fe777496b3d4944160b4e752e022e3a3e3d66e4c61481d0fd9fe238902a96ac9fd04c8bf |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 91bd438fa062f3e3db893e0f6f956a78 |
| SHA1 | cef35b2f04f7c704b24312341078f868682f881d |
| SHA256 | 73ae0579c9d2db33f7482471aa2747dd7747d78a81f627383b4a18a926b5c98a |
| SHA512 | 8956c71e215f72a4a9e5e3ab18e591676e423e638e51e8f3f80dd384d50850cb33fc870bc84adcbf23da68706a504c0d33ba86a9b2e10032a10de72d1044786a |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 5c1709048726a5f5a986dc190b2d4580 |
| SHA1 | 7cfdccca7039769d1669717cfbafde392177b784 |
| SHA256 | 60f43121f2eab5733fc70c26656a4a180459d61fbb1703a4ccb3eb5b0324fa31 |
| SHA512 | 5bd04cc086fe5f5c4fd207c0f4b7d00a2690771bde0bc137e37981250a70f3833bd07425d9092eafffbca2689a8d54db82f7f9e2e4dee605b15e8eb12ae31a03 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 7aa59bbeeedd03fe041bef2dc83c4072 |
| SHA1 | b299d36f12495ff247e2732e4974a196c21509e8 |
| SHA256 | 14da3238a9d35b7e28280dcf0405442ac8b1029b2b1c5c8eca7afec22714dd92 |
| SHA512 | d579b89b2ce69accc95beb4d9f79e2cae2d731fb7cf5f2d4f7f6890b345f02ec2def542ff3e4643208b8245ddda1f38369fde6bc6752deab25e74e4738e5395f |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 30e04b66a7cbf511cb1804da55c180d1 |
| SHA1 | b35f49d7cbf32fd196efff6cb5ae9a91853728ab |
| SHA256 | c8ce83c55343ad14c8394d82a747e085c5908aa99f54b4e84de60a820d78fce2 |
| SHA512 | 0f2546c814ddd4624449dc90eddd7d350cd0731eb986fc5ab38c6a5a268b466659b5001b936ecf0267a6848fd7347aa9faac58a756775ec9747103523046dd7f |
Analysis: behavioral2
Detonation Overview
Submitted
2024-06-13 07:38
Reported
2024-06-13 07:40
Platform
win10v2004-20240611-en
Max time kernel
145s
Max time network
138s
Command Line
Signatures
Enumerates system info in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Processes
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a47605c5a0d4e0a0471982e1bfe5b56d_JaffaCakes118.html
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xe0,0x108,0x7ffdb9ee46f8,0x7ffdb9ee4708,0x7ffdb9ee4718
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1996,16719464671795130091,8331295933843129976,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1996,16719464671795130091,8331295933843129976,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1996,16719464671795130091,8331295933843129976,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2628 /prefetch:8
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,16719464671795130091,8331295933843129976,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,16719464671795130091,8331295933843129976,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1996,16719464671795130091,8331295933843129976,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5464 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1996,16719464671795130091,8331295933843129976,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5464 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,16719464671795130091,8331295933843129976,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5124 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,16719464671795130091,8331295933843129976,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5032 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,16719464671795130091,8331295933843129976,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4624 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,16719464671795130091,8331295933843129976,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5008 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1996,16719464671795130091,8331295933843129976,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1304 /prefetch:2
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | cdnjs.cloudflare.com | udp |
| NL | 178.128.249.247:80 | 178.128.249.247 | tcp |
| US | 8.8.8.8:53 | use.fontawesome.com | udp |
| NL | 178.128.249.247:80 | 178.128.249.247 | tcp |
| NL | 178.128.249.247:80 | 178.128.249.247 | tcp |
| US | 8.8.8.8:53 | stackpath.bootstrapcdn.com | udp |
| NL | 178.128.249.247:80 | 178.128.249.247 | tcp |
| NL | 178.128.249.247:80 | 178.128.249.247 | tcp |
| NL | 178.128.249.247:80 | 178.128.249.247 | tcp |
| US | 8.8.8.8:53 | ajax.googleapis.com | udp |
| US | 104.18.10.207:443 | stackpath.bootstrapcdn.com | tcp |
| US | 172.67.142.245:443 | use.fontawesome.com | tcp |
| US | 104.17.24.14:443 | cdnjs.cloudflare.com | tcp |
| GB | 142.250.200.10:445 | ajax.googleapis.com | tcp |
| NL | 178.128.249.247:80 | 178.128.249.247 | tcp |
| NL | 178.128.249.247:80 | 178.128.249.247 | tcp |
| NL | 178.128.249.247:80 | 178.128.249.247 | tcp |
| NL | 178.128.249.247:80 | 178.128.249.247 | tcp |
| NL | 178.128.249.247:80 | 178.128.249.247 | tcp |
| NL | 178.128.249.247:80 | 178.128.249.247 | tcp |
| US | 8.8.8.8:53 | apps.identrust.com | udp |
| NL | 178.128.249.247:80 | 178.128.249.247 | tcp |
| NL | 178.128.249.247:80 | 178.128.249.247 | tcp |
| NL | 178.128.249.247:80 | 178.128.249.247 | tcp |
| NL | 178.128.249.247:80 | 178.128.249.247 | tcp |
| NL | 178.128.249.247:80 | 178.128.249.247 | tcp |
| BE | 23.14.90.73:80 | apps.identrust.com | tcp |
| NL | 178.128.249.247:80 | 178.128.249.247 | tcp |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 68.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 247.249.128.178.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 202.187.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 104.201.58.216.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 207.10.18.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 245.142.67.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 14.24.17.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 73.90.14.23.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.210.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 99.201.58.216.in-addr.arpa | udp |
| US | 8.8.8.8:53 | ajax.googleapis.com | udp |
| GB | 142.250.178.10:139 | ajax.googleapis.com | tcp |
| US | 8.8.8.8:53 | 14.213.58.216.in-addr.arpa | udp |
| NL | 23.62.61.185:443 | www.bing.com | tcp |
| US | 8.8.8.8:53 | 55.36.223.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 185.61.62.23.in-addr.arpa | udp |
| N/A | 224.0.0.251:5353 | udp | |
| NL | 178.128.249.247:80 | 178.128.249.247 | tcp |
| US | 8.8.8.8:53 | 26.165.165.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 171.39.242.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 144.107.17.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 203.107.17.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 14.227.111.52.in-addr.arpa | udp |
Files
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | 3a09f853479af373691d131247040276 |
| SHA1 | 1b6f098e04da87e9cf2d3284943ec2144f36ac04 |
| SHA256 | a358de2c0eba30c70a56022c44a3775aa99ffa819cd7f42f7c45ac358b5e739f |
| SHA512 | 341cf0f363621ee02525cd398ae0d462319c6a80e05fd25d9aca44234c42a3071b51991d4cf102ac9d89561a1567cbe76dfeaad786a304bec33821ca77080016 |
\??\pipe\LOCAL\crashpad_208_VPJGFJWVBENWOOIM
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | db9081c34e133c32d02f593df88f047a |
| SHA1 | a0da007c14fd0591091924edc44bee90456700c6 |
| SHA256 | c9cd202ebb55fe8dd3e5563948bab458e947d7ba33bc0f38c6b37ce5d0bd7c3e |
| SHA512 | 12f9809958b024571891fae646208a76f3823ae333716a5cec303e15c38281db042b7acf95bc6523b6328ac9c8644794d39a0e03d9db196f156a6ee1fb4f2744 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | 6c617e4d9d7939c12c4cff366f0c3ca8 |
| SHA1 | 62f24ed33ab11beea78723674f475ceb42bdefcc |
| SHA256 | d6ce2797cd464ca52c7bbc96f0f6f6c58f7338955f3f73ea19ccdf2a857c1a6f |
| SHA512 | 18619971c83fbbafbaf25dd82c1db5d817055de04ceee0d8f439194c7fff73be9a69d4b9cbb723c8884bfac1387e79316c865bd12c7dc3363402f230423e3528 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
| MD5 | e61896018af7037f3d513cca2adbddf3 |
| SHA1 | 61dd62eb66b14745356660142576e5179f57e62c |
| SHA256 | 62d3c259abe9fe0967e2205df5c34aff515b1cd29cd1843cdcf33d37fcf8a367 |
| SHA512 | c6fdab9544a2f42d22c28bb35a96eb486e3e6f711d9699f2620dc59814d0dc1053a8641f463bf70b0bda74ae110f6246ea74f03b5d3b0740b598d66888283dd1 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\920f6f2f-f6fb-483f-b0f8-8776954a8656.tmp
| MD5 | b2d3382e6e42e9a379c35ff722f58cc8 |
| SHA1 | 3fc733d6a623671d851cdef1e9a54a9219e945ee |
| SHA256 | bbfd64094a6bae0a83e27024dc4439870236de2ecd823a4a29bf93f000f72fdb |
| SHA512 | 41fdad87c7359e8ea7898c3044b82f1364b2b0fbef545de5b332c030779f85888d92e7a91972f0f60e3eb381e28d52e40bd31b7514bdbbd1d736fba9470a9bbd |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
| MD5 | 6752a1d65b201c13b62ea44016eb221f |
| SHA1 | 58ecf154d01a62233ed7fb494ace3c3d4ffce08b |
| SHA256 | 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd |
| SHA512 | 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | 711923bc2d5fc6e3f6b13ac3f31ae0b9 |
| SHA1 | 0814220038f6135a7d68e5f7e0a201944f88e55b |
| SHA256 | 9a5dd13afd54e84b7bd39e911b2b5ff864a1a92cf37aaeff8c9eb862d27b56d9 |
| SHA512 | 11869a7fdc1a89ea86bfd9aa8d87e988b6e6f2645b9e117a12f676a4e7b059fae189bac803a8b6a68f1930323f93790141998416edbdd3b3feed5e767a8ba682 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
| MD5 | ca87d07029fea8682c3bfcd4d74c42ec |
| SHA1 | cf392e777a531ee30ff7a5e91bedcf9491cb5ef1 |
| SHA256 | c226a701eeb857198e81e5f2e96151f64cf326ebbf805433b99e801f026aa31c |
| SHA512 | 6503d0b91d46935c021bccd21b51245852f21013aa848e6f264da4e975c4de691e77dab21154e70dd514e937fd1fcf1d33c9b7d2e61406ca3c6a216f8382e664 |